Making product cybersecurity practical for industrial manufacturers in the UK and Ireland

Industrial products are becoming increasingly connected. From controllers and sensors to drives, gateways and automation equipment, manufacturers are incorporating more software and digital capabilities into the products they develop and sell.

As a result, cybersecurity is increasingly important to product development, customer expectations and market access. For manufacturers selling products into the European Union, the EU Cyber Resilience Act (CRA) adds a significant regulatory consideration.

The question is practical: how can we meet evolving cybersecurity expectations and prepare for new obligations without creating unnecessary complexity for our engineering teams?

IEC 62443 and the CRA: two important reasons to act

IEC 62443 provides an internationally recognised framework for industrial cybersecurity. It helps manufacturers take a more structured approach to secure product development, meet customer expectations and build confidence in their products.

The EU Cyber Resilience Act introduces cybersecurity obligations for products with digital elements within its scope when they are placed on the EU market. This can affect UK and Irish manufacturers supplying relevant products to EU customers, even if the manufacturer is based outside the EU.

Certain CRA vulnerability and incident reporting obligations began applying in September 2026, with the main requirements applying from December 2027. Manufacturers need to understand which of their products are in scope and what obligations apply.

IEC 62443 can provide a valuable foundation for CRA readiness, but alignment or certification with IEC 62443 does not automatically establish CRA conformity. The opportunity is to address customer expectations and regulatory requirements through one coherent product cybersecurity approach.

The challenge is making it practical

Many industrial manufacturers already have strong engineering and quality-management processes. What they may lack is a consistent way to incorporate cybersecurity into those processes, demonstrate what has been done and maintain security after products are released.

For organisations with lean engineering teams, a large standalone compliance programme is rarely the answer. A more sustainable approach builds on existing capabilities, prioritises the most important improvements and makes cybersecurity part of everyday engineering.

Industrial experience, applied practically

Helping industrial manufacturers address product cybersecurity requires more than an understanding of standards and regulations. It requires practical experience of industrial environments, engineering processes and the challenges of implementing change.

Acuteagility brings industrial and OT cybersecurity expertise, helping organisations understand their cybersecurity challenges, assess relevant requirements and turn them into practical improvement plans that fit their business and engineering operations.

Cyberismo brings specialist product cybersecurity expertise, supporting technology and experience working with industrial manufacturers. This includes helping Kalmar prepare its secure-development lifecycle for IEC 62443-4-1 certification and contributing to the Finnish Recovery Boiler Committee’s practical automation cybersecurity guidance, addressing IEC 62443, the EU Cyber Resilience Act and other relevant requirements.

Together, Acuteagility Consulting and Cyberismo combine industrial cybersecurity advisory and implementation support with specialist secure-development expertise, tools and learning resources. Our aim is to help industrial manufacturers across the UK and Ireland take a practical, proportionate approach to IEC 62443 and CRA readiness, building on their existing engineering capabilities rather than introducing unnecessary complexity.

Supporting industrial manufacturers across the UK and Ireland

Our joint focus is on industrial product manufacturers across the UK and Ireland, particularly organisations developing connected equipment, embedded systems, industrial controllers and automation technologies.

Many of these manufacturers have strong engineering capabilities but limited dedicated resources for managing the growing demands of product cybersecurity.

For manufacturers placing products with digital elements on the EU market, including UK exporters and manufacturers based in Ireland, the Cyber Resilience Act adds an important regulatory consideration alongside increasing customer expectations around IEC 62443. Applicability depends on the product and its circumstances.

Acuteagility Consulting and Cyberismo are working together to help manufacturers navigate both challenges, combining practical industrial cybersecurity guidance with specialist secure-development expertise, technology and learning resources. Our focus is on meaningful progress without the overhead of an unnecessarily complex compliance programme.

How we would typically work with you

Every manufacturer starts from a different position. You may be responding to an IEC 62443 request from a customer, considering how the CRA affects your product portfolio or looking to improve your existing product-security practices. We would typically work with you through four flexible stages.

1. Assess: understand where you are today

We would review your products, existing processes and business priorities to identify the most important cybersecurity gaps and agree a realistic improvement roadmap.

2. Implement: build cybersecurity into existing engineering

We would help introduce practical secure-development activities and supporting workflows, using Cyberismo’s expertise and technology where appropriate, while building on the tools and processes you already have.

3. Enable: build confidence and capability

We would support your teams with relevant guidance, workshops and learning so that cybersecurity responsibilities are understood and can be managed as part of everyday work.

4. Operate: make cybersecurity sustainable

We would help establish ongoing practices for maintaining product security, handling vulnerabilities and supporting customer and regulatory expectations throughout the product lifecycle.

You may need help with just one stage or across the entire journey. The approach would be tailored to your products, engineering environment and business priorities.

Making product cybersecurity practical

For industrial manufacturers, product cybersecurity is about more than technical risk. It is about customer confidence, market access, product reputation and the ability to maintain products securely over time.

IEC 62443 provides a strong foundation. The CRA adds urgency for manufacturers placing relevant products with digital elements on the EU market. Acuteagility Consulting and Cyberismo help bring these considerations together in an approach that works for your business.

Let’s start with a conversation

Whether you are exploring IEC 62443, assessing the implications of the CRA or looking for a more structured approach to product cybersecurity, we would welcome a conversation about where you are today and what a practical next step could look like.

In the UK and Ireland, please contact Acuteagility. Elsewhere, please contact Cyberismo.

About Acuteagility

Acuteagility Consulting helps industrial manufacturers, technology providers and businesses across the UK and Ireland make cybersecurity practical, proportionate and achievable. It combines industrial cybersecurity expertise, strategic advisory and practical implementation support. Its services cover industrial and OT cybersecurity, product cybersecurity and secure development, IEC 62443 advisory and implementation, EU Cyber Resilience Act readiness, vulnerability management and SBOM, and cyber risk and threat intelligence.